具變形躲避偵測機制穿透測試載具

Penetration Testing Approach by Mutating Sled of Exploit

許明淵(Ming-Yuan Hsu)

指導教授 ： 楊明豪 ； 羅嘉寧

中原大學/工學院/資訊工程研究所/碩士(2008年)

https://doi.org/10.6840/cycu200800221

摘要

由於蠕蟲可利用來快速擴散攻擊的目標，若是蠕蟲載送惡意程式碼且利用加密的手法來躲過入侵偵測系統(IDS)，則會對現今之網路防護體系造成莫大之傷害，而以往蠕蟲的Shellcode是IDS做為判別確認是否為網路攻擊的主要特徵，而因此攻擊者為了躲避偵測，會將Shellcode透過簡單的加密以達到躲避的效果，也就是一般所稱的變形蟲。
為了防範變形蟲，我們首先要研究變形蟲是否有變化的可能性能夠躲過現有之IDS偵測機制，因此我們在本論文中探討並利用加密機制和多元的解密器來測試現有之特徵辨識IDS Snort是否可以正常偵測到我們的穿透測試載具，以及我們提出改變蠕蟲中的滑動區段必須能夠從任一位元組開始執行並正常的執行到Shellcode之特性以及調整OP code分佈使得一些分析可執行碼之IDS 如STRIDE、APE是否可成功偵測我們所產生之變形蟲。
我們並於實驗室中利用所蒐集之Sasser、Blaster蠕蟲為基底進行變形、並加入正常之背景流量於我們的實驗環境中，對Snort和STRIDE進行比對測試。發現能夠成功的躲過入侵偵測系統，並將測試程式利用我們的載具攜帶至目的端電腦，而有9成以上的機率成功進行擴散。

關鍵字

滑動區段 ； 穿透測試 ； 入侵偵測系統 ； 變形蟲 ； shellcode

並列摘要

A worm is usually used to speedy spread the exploit code to host in the internet, and if it utilizing the encrypting technique, would causes the serious disasters. Since the traditional IDS are not able to detect the shellcode of the encrypted polymorphic worm.
For against the polymorphic worm, we need to research how the polymorphism could mutate to evade the current detection mechanism. In this paper, we analyses and used the encryption and polymorphic decoder to test whether the IDS Snort, a signature-based IDS could detect out penetration testing tool or not. We propose a scheme to mutate the signature of a worm, to let any byte in sled and shellcode of the worm could be executed normally on destination to evade the IDSs like STRIDE or APE.
Finally, we use Sasser and Blaster worms as examples to blend into normal traffic in our experiment and emulate a penetration test to IDSs, Snort and STRIDE. According to the emulation results, our penetration testing tool could be successful possess the exploit code and evading the IDS to the end host above 90%.

並列關鍵字

sled ； IDS ； shellcode ； polymorphism ； penetration test

參考文獻

[1]R. Sommer and V. Paxson, "Enhancing byte-level network intrusion detection signatures with context," Proceedings of the 10th ACM conference on Computer and communications security, pp. 262-271, 2003.

[2]C. Krugel, T. Toth, and E. Kirda, Service specific anomaly detection for network intrusion detection: ACM Press New York, NY, USA, 2002.

[8]P. Akritidis, E. P. Markatos, M. Polychronakis, and K. Anagnostakis, "Stride: Polymorphic sled detection through instruction sequence analysis," 20th IFIP International Information Security Conference, 2005.

[11]T. Toth and C. Kruegel, "Accurate buffer overflow detection via abstract payload execution," Proceedings of the, vol. 5, pp. 274–291.

[15]P. Jungck, S. S. Y. Shim, and C. S. Technologies, "Issues in high-speed Internet security," IEEE Computer, vol. 37, pp. 36-42, 2004.